Security audit

Amazon-analysis-skill

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Amazon product-research skill, but it needs Review because it can save API keys in plaintext and includes broad external-data workflows with some under-scoped profiling guidance.

Install only if you are comfortable sending Amazon research queries, ASINs, categories, and competitor/review targets to APIClaw. Prefer setting APICLAW_API_KEY as an environment variable instead of giving the key to the agent or saving it in config.json. Avoid using the Chinese seller case workflow for nationality profiling from names or stereotypes; rely only on explicit seller location fields. Verify the installer source or use a pinned installation path.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:35
Finding: Unpinned Remote Package Execution in the Recommended Installation Procedure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:23
Finding: Plaintext API-Key Persistence Without Enforced File Protections
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (28)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
> AI-powered Amazon product research. From market discovery to daily operations. > > **Language rule**: Always respond in the user's language. If the user asks in Chinese, reply in Chinese. If in English, reply in English. The language of this skill document does not affect output language. > All API calls go through `scripts/apiclaw.py` — one script, 5 endpoints, built-in error handling. ## Credentials

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs writing user-supplied API keys to config.json without any explicit warning that this persists credentials locally. This is dangerous because users may provide secrets expecting one-time use, while the skill creates a durable copy that could be exposed to subsequent file reads, syncing, or unintended sharing.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
| `SKILL.md` (this file) | Start here — covers 80% of tasks |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The script reads API credentials from both an environment variable and a local config file in the skill directory. Accessing secrets from a file inside the skill tree increases the chance of accidental inclusion in backups, source control, packaging, or broader filesystem exposure, especially in agent environments where skills may be copied or inspected.
Content: Scanner excerpt · scripts/apiclaw.py (reported line 64)May include surrounding context.
python
def get_api_key(): """ Get API key from environment variable or config file. Priority: 1. Environment variable APICLAW_API_KEY

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run npx clawhub install Amazon-analysis-skill without pinning an exact package version. npx will fetch and execute the latest published package, so a compromised upstream package, typosquat, or malicious update could result in arbitrary code execution on the user's machine during installation. In the context of an AI-agent skill that may be installed by less technical users, this increases supply-chain risk rather than reducing it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README tells users to give their API key to the AI agent so it can auto-save the credential to config.json, but it provides no warning about storage location, file permissions, redaction, or the risk of exposing secrets to the model context, logs, or other tools. In a skill designed for agent use, encouraging users to paste live credentials directly into the agent is especially risky because the key may be retained in conversation history or written insecurely to disk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill appears capable of using environment variables, reading local files, and making network calls, but it does not declare an explicit tool scope such as allowed-tools or permissions. That mismatch weakens reviewability and least-privilege controls, making it harder to constrain the skill if it is triggered too broadly or later modified to perform riskier actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger scope is very broad, including generic requests like 'any Amazon seller data needs' and 'find products,' which can cause the skill to activate in many contexts. Combined with network, env, and file capabilities, overbroad routing increases the chance of unnecessary secret access or execution in situations where the user did not intend to invoke this external integration.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document claims the API key is used only for api.apiclaw.io, but later instructs saving a provided key to a local file. That inconsistency is security-relevant because it can mislead users and reviewers about actual credential handling, undermining informed consent and trust boundaries.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions tell the agent to persist a user-provided API key into config.json, which creates a local credential copy beyond transient runtime use. Storing secrets on disk increases exposure to later reads by other skills, debugging workflows, logs, backups, or accidental disclosure, and is not necessary when an environment variable is already supported.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The listed triggers include generic everyday phrases such as "help me choose" and "most suitable for me," which are not narrowly tied to this specific product-recommendation skill. Because the file does not provide exclusion conditions or tighter context boundaries, these phrases could overlap with many unrelated user requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger includes the very broad phrase 'Chinese sellers', which can cause the skill to activate on requests involving nationality-focused analysis without clear business or safety constraints. In this skill, that broad trigger is more dangerous because the downstream workflow already contains nationality inference heuristics, so loose invocation increases the chance of profiling-oriented analysis being run inappropriately.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This guidance explicitly instructs the agent to infer whether sellers are 'Chinese' using sellerLocation plus fallback heuristics based on names, brand patterns, and product-category stereotypes. That goes beyond ordinary product analytics into sensitive nationality/ethnicity inference, and the fallback logic is especially risky because it encourages profiling from weak proxies that can be inaccurate and discriminatory.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases in the risk assessment section include very broad everyday language such as 'can I do this' and 'what are the risks', which can match many unrelated user requests. In an agent skill, overly broad triggers can cause the wrong skill workflow to activate, leading to unnecessary external API use, irrelevant analysis, or unintended handling of user data and requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The category consumer insights section uses ambiguous triggers like 'what do users want' and 'who is buying', which are common conversational phrases outside the Amazon seller context. This increases the chance of accidental invocation for unrelated conversations, causing misrouting to this skill and potentially exposing user prompts to third-party product-analysis tooling without sufficient relevance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file instructs the agent to pull competitor ASINs, reviews, and market data, but it does not clearly warn the user up front that third-party competitor/product data will be fetched and analyzed. This weakens informed consent and transparency, especially where the user's request may sound like ordinary content generation rather than external market intelligence gathering.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases for listing copy generation are broad enough to match generic writing requests such as 'write listing' or 'help me write product page,' which can cause the skill to activate when a user did not clearly request external Amazon/competitor analysis. That can lead to unintended retrieval and processing of competitor/product data and make the agent take domain-specific actions without sufficiently clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The diagnosis triggers like 'optimize my listing' and 'improve my listing' are ambiguous and can overlap with ordinary copy-editing or marketing requests. In this skill, matching those phrases may initiate competitive intelligence lookups and review analysis, so insufficient scoping creates a risk of unexpected external data access and overly aggressive tool use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text says to load this scenario for broad tasks like pricing strategy, profit estimation, or listing reference, without clear boundaries on when it should or should not be used. Overly broad invocation criteria can cause the agent to activate this skill in loosely related contexts, increasing the chance of inappropriate tool use, unnecessary data access, or responses shaped by the wrong workflow.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This skill transmits user queries and derived product-research parameters to a third-party service over the network. While that is core to the skill's function, it creates a real data-exposure boundary: user-supplied keywords, categories, ASINs, and analysis targets leave the local environment and are subject to the external provider's logging, retention, and access controls.
Content: Scanner excerpt · scripts/apiclaw.py (reported line 32)May include surrounding context.
python
# ─── Configuration ─────────────────────────────────────────────────────────── BASE_URL = "https://api.apiclaw.io/openapi/v2" # APIClaw API base URL API_DOCS = "https://api.apiclaw.io/api-docs" # API documentation URL MAX_RETRIES = 2 # Maximum number of retry attempts for failed requests RETRY_DELAY = 2 # Initial retry delay in seconds; doubles on 429 (rate limit)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/reference.md (reported line 21)May include surrounding context.
md
# ─── Configuration ─────────────────────────────────────────────────────────── BASE_URL = "https://api.apiclaw.io/openapi/v2" # APIClaw API base URL API_DOCS = "https://api.apiclaw.io/api-docs" # API documentation URL MAX_RETRIES = 2 # Maximum number of retry attempts for failed requests RETRY_DELAY = 2 # Initial retry delay in seconds; doubles on 429 (rate limit) REQUEST_TIMEOUT = 60 # Request timeout in seconds; realtime/product can be slow (up to 30s)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/apiclaw.py (reported line 33)May include surrounding context.
python
# ─── Configuration ─────────────────────────────────────────────────────────── BASE_URL = "https://api.apiclaw.io/openapi/v2" # APIClaw API base URL API_DOCS = "https://api.apiclaw.io/api-docs" # API documentation URL MAX_RETRIES = 2 # Maximum number of retry attempts for failed requests RETRY_DELAY = 2 # Initial retry delay in seconds; doubles on 429 (rate limit) REQUEST_TIMEOUT = 60 # Request timeout in seconds; realtime/product can be slow (up to 30s)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The tool explicitly instructs users to persist the API key in a plaintext config.json file in the skill directory. That creates a durable secret on disk in a location likely to be shared, copied, archived, or inadvertently committed, increasing the window for credential theft and misuse.
Content: Scanner excerpt · scripts/apiclaw.py (reported line 98)May include surrounding context.
python
print(" export APICLAW_API_KEY='hms_live_yourkey'", file=sys.stderr) print("", file=sys.stderr) print(" Method 2: Config file", file=sys.stderr) print(f" Create config.json in the skill directory: {skill_dir}", file=sys.stderr) print(' Content: {"api_key": "hms_live_yourkey"}', file=sys.stderr) print("", file=sys.stderr) print("Get a free key at https://apiclaw.io/api-keys", file=sys.stderr)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This markdown file documents use of Bearer $APICLAW_API_KEY, which involves a sensitive credential. The reference provides no warning about protecting the API key, avoiding accidental logging/sharing, or ensuring it is set securely, despite SQP-2 applying to markdown files that describe privacy- or integrity-affecting behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The get_api_key docstring documents a fallback config file in the skill directory, and the implementation of get_api_key follows that behavior. However, cmd_check uses a different undocumented path ~/.apiclaw/config.json, creating an active mismatch between the documented credential source and actual behavior in the self-check path.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.